Tango Toolbar goes quietly

What is the Tango Toolbar?

Recently came across a new discovery which has become quickly infamous on the web: the tango toolbar. Seems I’m so quick to write a post on this, wikipedia doesn’t yet have an article on it. People seem to be finding this toolbar on their computers without any real awareness of where they got it. It also seems people have been having some serious trouble removing this annoyance. Seems like some AV software is now finding tango.dll as a trojan.

The clients computer that I was working on was a Vista system that was strangely redirecting searches to a page that looked like this:

Sunbelt blog has a detailed post on the tango toolbar here. Also The Security Blog calls the tango toolbar mysterious, read their post here.

How to Remove Tango Toolbar?

I didn’t do anything fancy in my approach to the toolbar. Since I was going about a routine cleaning of a system, I hadn’t at that time heard anything yet about this Tango Toolbar. I ran my usual cleanups with ccleaner and malwarebytes. That’s when I noticed the toolbar was still do its thing, and IE searches were getting redirected. I utilized Hijackthis and was able to quickly find the BHO’s and other related files. Using Hijackthis to cleanup this toolbar was not a problem. Just make sure you clean off the correct files and you’ll be fine. There are some good online tools for parsing hijackthis logs which you can locate here.

Your thoughts?

Of course perhaps you have had other experiences and or difficulties, maybe it didn’t go quite so quietly for you? Your comments would be appreciated.